Google Workspace28 OF 28 CAPABILITIES ASSESSED

Google Workspace groups, drives and licences are granted from Ploy

Users, groups, shared drives and org units, with licences reclaimed and OAuth tokens revoked on the leaver run.

TYPE · IDPAUTH · OAUTHDOMAIN · WORKSPACE.GOOGLE.COM

Google Workspace connectorHOURLY SYNCCAPABILITIES

WHAT PLOY DOES

Sync accounts, status and last sign-inEvery Google Workspace account, whether it is active or suspended, and when it last signed in.

READ

Import directory profiles as peopleJob title, department, manager, location and employment dates from the mapped directory fields. The record is dropped when a dedicated HR system already owns that employee.

READ

Discover groups, shared drives and org unitsThe grantable things in Workspace and who holds each of them, at what level. Individual Drive files are not enumerated.

READ

Read 2-step verification state and licence seatsWhich accounts have a second factor registered, and which licence SKUs are assigned against the seats you bought.

READ

Find the third-party apps people have connectedDiscovered from the OAuth token grants sitting on user accounts, so shadow IT arrives with the account that authorised it.

READ

Create, update and suspend accountsPloy opens the Workspace account a joiner needs, keeps the profile in step with a move, and suspends it on a leaver.

WRITE

Grant and revoke groups, shared drives, org units and admin rolesThe grant path for Workspace access. Identity provider app assignments can be removed but not added.

WRITE

Reclaim licences, reset passwords and revoke OAuth tokensA leaver hands their seat back and the tokens third-party apps hold are revoked. Active browser sessions are not force-ended.

WRITE

2.1WHAT IT UNLOCKS

Three jobs this connector does on day one

ACCOUNTS

The account is created, not requested

A joiner arrives from the HR system with their role. Ploy creates the Google Workspace account, sets the profile fields policy depends on and assigns the licence.

ACCESS

Groups and shared drives are the grant

An approved request writes group, shared drive or org unit membership straight into Workspace, and drops it again when the window closes.

OFFBOARDING

Suspended, reclaimed and revoked

On the last working day Ploy suspends the account, hands the licence seat back and revokes the OAuth tokens connected apps were issued. Active browser sessions are not force-ended.

2.3